Privacy Policy

This Privacy Policy explains how 20th Labs Ltd (“we”, “us”, “our”), a company registered in the United Kingdom, collects, uses, and protects your information when you use Outlink (the “Service”), available at outlink.so and app.outlink.so.

By using Outlink, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

For any privacy questions, contact us at support@outlink.so.

1. Who we are

Outlink is a link-building outreach platform operated by 20th Labs Ltd. We help users discover backlink prospects, evaluate them using SEO data, and conduct email outreach from the user’s own connected mailbox.

Data controller: 20th Labs Ltd (United Kingdom)
Contact: support@outlink.so

2. Information we collect

a) Information you provide directly

• Account information: your name and email address when you register.
• Authentication data: if you sign in with Google, we receive your basic Google profile information (name, email address, and email-verified status) via Google Sign-In.
• Content you create or import: prospect lists, contacts, campaigns, email templates, notes, deal information, and any data you upload (e.g. CSV imports).
• Payment information: when you subscribe, payment is processed by our third-party payment provider. We do not store your full card details on our servers.

b) Mailbox data (Google / Microsoft accounts you connect)

When you connect an email account to send outreach, we access that mailbox strictly to provide the Service. See Section 4 for full detail on Google user data.

c) Information collected automatically

• Usage data: how you interact with the Service (features used, actions taken).
• Log and device data: IP address, browser type, and timestamps, used for security and to operate the Service.
• Cookies and similar technologies: used for authentication and to keep you signed in. See Section 9.

d) SEO and prospecting data

When you research prospects, we retrieve publicly available domain and SEO metrics (such as domain rating, estimated traffic, backlink counts, and spam scores) and publicly available contact information from third-party data providers, on your behalf.

3. How we use your information

We use your information to:

• Provide, operate, and maintain the Service;
• Authenticate you and secure your account;
• Send outreach emails from your connected mailbox at your direction;
• Detect replies to your outreach so campaigns can respond appropriately (e.g. stop sending when a recipient replies);
• Retrieve SEO metrics and contact data you request;
• Process payments and manage your subscription;
• Provide customer support;
• Improve and develop the Service;
• Comply with legal obligations and enforce our Terms.

We do not sell your personal data. We do not use the content of your connected mailbox for advertising, profiling, or any purpose unrelated to operating the Service.

4. Google user data — how Outlink uses Gmail access

When you choose to connect a Google account to send outreach, Outlink requests specific, limited permissions (OAuth scopes). This section describes exactly what we access and why, in line with the Google API Services User Data Policy, including its Limited Use requirements.

Scopes we request and why:

• Send email on your behalf (gmail.send) — to send the outreach emails and follow-ups you create, from your own address.
• Read email (gmail.readonly) — to detect replies to your outreach threads, so campaigns can stop sending to people who have replied and so you can see responses inside Outlink.

How we use this access — and how we don’t:

• We access your mailbox only to send the messages you configure and to detect and display replies to your outreach.
• We do not read, scan, or process mail unrelated to your outreach for any purpose.
• We do not use your Gmail data to train generalized artificial-intelligence or machine-learning models.
• We do not sell or transfer your Gmail data to third parties, except as necessary to provide the Service (e.g. our cloud/email infrastructure providers acting on our behalf), for security purposes, or to comply with applicable law.
• We do not use your Gmail data for advertising.
• Human access to your Gmail data is limited to cases where you explicitly consent, where required for security or to comply with law, or where the data has been aggregated and anonymized.

Storage and security of Google data:

• Access and refresh tokens for your connected mailbox are stored encrypted at rest and used only by our secure backend to perform the actions above.
• You can disconnect your mailbox at any time from within Outlink, and you can revoke Outlink’s access to your Google account at any time via your Google Account security settings (https://myaccount.google.com/permissions).

Limited Use disclosure: Outlink’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

(The same principles apply to Microsoft/Outlook mailboxes you connect: access is limited to sending your outreach and detecting replies.)

5. How we share information

We share information only as follows:

• Service providers / sub-processors who help us operate the Service (e.g. cloud hosting, database, payment processing, email data providers), bound by contractual confidentiality and data-protection obligations, acting on our instructions.
• Legal and safety: where required by law, or to protect our rights, users, or the public.
• Business transfers: if we are involved in a merger, acquisition, or asset sale, information may be transferred, subject to this policy.

We do not sell your personal data to third parties.

6. Data retention

We retain your information for as long as your account is active or as needed to provide the Service. If you close your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain it for legal, tax, or security reasons. You can request deletion at any time (Section 8).

7. Data security

We implement technical and organizational measures to protect your information, including encryption of sensitive credentials at rest, access controls, and row-level security in our database. No method of transmission or storage is 100% secure, but we work to protect your data and to respond promptly to any incident.

8. Your rights

Depending on your location (including under UK GDPR and EU GDPR), you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data (“right to erasure”);
• Restrict or object to certain processing;
• Data portability;
• Withdraw consent at any time (e.g. by disconnecting your mailbox).

To exercise any of these rights, contact support@outlink.so. You also have the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner’s Office).

9. Cookies

We use cookies and similar technologies that are necessary to authenticate you and operate the Service (for example, to keep you signed in). We do not use these for third-party advertising. You can control cookies through your browser settings, though disabling essential cookies may prevent you from using the Service.

Embedded video. Our marketing pages embed a video hosted by YouTube. Nothing loads from YouTube or Google until you click play: the page shows a preview image served from our own domain, and only your click loads the player, from youtube-nocookie.com (YouTube’s privacy-enhanced domain). After you click play, YouTube receives your IP address and browser details and may set cookies or use similar storage under Google’s privacy policy.

Analytics. We count page visits and a few product events (such as signing up and starting a checkout, with the plan chosen) using Umami, a cookieless analytics tool. The tracking script is served from our own domain and reports to a self-hosted Umami server at umami.website, run for us by a business partner. Each report contains the page address (without its query string on app.outlink.so), the referring page, the page title, and your browser’s language and screen size, and, as with any web request, your IP address and browser details. It sets no cookies, and we never send your name, email address or account identifiers.

10. International data transfers

We are based in the United Kingdom and may process data in other countries where our service providers operate. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses).

11. Children’s privacy

Outlink is a business tool not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version here and update the “Last updated” date. Material changes will be communicated where appropriate.

13. Contact

For any questions about this Privacy Policy or your data, contact:

20th Labs Ltd
Email: support@outlink.so